search

Zentific / vmidbg

PoC LibVMI-based GDB server for virtual machines
Other
53 stars 16 forks source link

Question: Working process #6

Closed mbhatt1 closed 6 years ago

mbhatt1 commented 6 years ago

Hi,

I kinda don't understand how this works. Say I have vmidbg running on the host machine and I connect gdb on dom0 to localhost:PORT. Does this imply that I need a copy of the domU executable in dom0 for the symbols? Also in the example it is shown that the symbols belong to the kernel. Does vmidbg work on kernels or can I attach it to any process in domU? And how would I do that?

Manish

smaresca commented 6 years ago

@mbhatt1 yes that's correct, you will need symbols on the same system that is acting as a client. The client gdb can be remote relative to the system where vmidbg is running; it needn't be done all via localhost.

vmidbg does primarily focus on the kernel. However, some (still incomplete) code in vmidbg uses GDB thread id specifiers to indicate pid and thread in stop packets, used to indicate that a breakpoint was hit etc.

It's very possible that vmidbg could extend to userspace processes, but that is not well realized at this time.

mbhatt1 commented 6 years ago

Hey, can u please direct me to resources that you went through to create this project?

smaresca commented 6 years ago

I would recommend looking at both GDB source code, and the documentation within the GDB source code itself. It has a makefile target to build a PDF with the latest GDB serial protocol. I believe the document is titled "Debugging with gdb" and the section you need to reference is the "Remote Serial Protocol"

Please know that this code is not robust. It is at best a proof of concept with many deficiencies. I do have some recent updates that I will push, but I'd be very open to contributions if you make improvements.

mbhatt1 commented 6 years ago

Cool beans!